From 5269978ad17fff8988f94a2327fa750e5d70c14d Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Wed, 2 Feb 2022 11:29:39 +0100
Subject: [PATCH] Allow sanlock get attributes of filesystems with extended
 attributes

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/5269978ad17fff8988f94a2327fa750e5d70c14d
Conflict: NA

Addresses the following AVC denial:
type=PROCTITLE msg=audit(01/28/2022 09:41:01.094:1832) : proctitle=/usr/sbin/sanlock daemon
type=AVC msg=audit(01/28/2022 09:41:01.094:1832) : avc:  denied  { getattr } for  pid=37165 comm=sanlock name=/ dev="dm-3" ino=128 scontext=system_u:system_r:sanlock_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0
type=SYSCALL msg=audit(01/28/2022 09:41:01.094:1832) : arch=x86_64 syscall=statfs success=no exit=EACCES(Permission denied) a0=0x7fdade30b49d a1=0x7ffeeeb41a70 a2=0x49 a3=0x1000 items=0 ppid=1 pid=37165 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sanlock exe=/usr/sbin/sanlock subj=system_u:system_r:sanlock_t:s0-s0:c0.c1023 key=(null)

Resolves: rhbz#2047811
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/contrib/sanlock.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/contrib/sanlock.te b/policy/modules/contrib/sanlock.te
index 04bd655..914062b 100644
--- a/policy/modules/contrib/sanlock.te
+++ b/policy/modules/contrib/sanlock.te
@@ -96,6 +96,7 @@ domain_use_interactive_fds(sanlock_t)
 files_read_mnt_symlinks(sanlock_t)
 
 fs_getattr_cgroup(sanlock_t)
+fs_getattr_xattr_fs(sanlock_t)
 fs_rw_cephfs_files(sanlock_t)
 
 storage_raw_rw_fixed_disk(sanlock_t)
-- 
1.8.3.1